On Wed, Jun 19, 2019 at 2:07 PM Jamie Strandboge <jamie@xxxxxxxxxxxxx> wrote: > > On Wed, 19 Jun 2019, Christian Ehrhardt wrote: > > > Commit a3ab6d42 changed the libvirtd profile to a named profile > > but neglected to accommodate the change in the qemu profile > > ptrace and signal rules. > > Later on 4ec3cf9a fixed that for ptrace and signal but openGraphicsFD > > is still missing. > > > > As a result, libvirtd is unable to open UI on libvirt >=5.1 e.g. with > > virt-manager. > > > > Add openGraphicsFD rule that references the libvirtd profile > > by name in addition to full binary path. > > > > Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1833040 > > > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx> > > --- > > src/security/apparmor/libvirt-qemu | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu > > index 165558fe83..d33348aa05 100644 > > --- a/src/security/apparmor/libvirt-qemu > > +++ b/src/security/apparmor/libvirt-qemu > > @@ -208,6 +208,7 @@ > > /sys/firmware/devicetree/** r, > > > > # allow connect with openGraphicsFD to work > > + unix (send, receive) type=stream addr=none peer=(label=libvirtd), > > unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd), > > > > # for gathering information about available host resources > > +1 to apply. Thanks for chasing this down. Thanks for the review Jamie. Given that the change is rather safe I'm pushing it without waiting much longer. > -- > Jamie Strandboge | http://www.canonical.com -- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
